In 2021, the watchdog Privacy and Civil Liberties Oversight Board delivered to Congress two reports assessing the impact that two CIA programs had on American privacy and civil liberties, and whether the programs followed existing laws and policies. Heinrich and Wyden, in their now-declassified letter, claim that the reports showed that “the nature and full extent of the CIA’s collection was withheld” from the Intelligence Committee and urged that the materials be made public.
On Thursday, the CIA released one of the reports — related to its handling of terrorist financing data — but concluded that the second “must remain classified in full to protect sensitive tradecraft methods and operational sources.”
The CIA did make public the oversight board’s recommendations related to the second, still-classified report, including several related to how analysts query existing databases for information involving known or presumed US persons.
But the nature of the program — including what kind of data has been collected and how many Americans’ records are maintained as part of the program — remains classified.
In general, the CIA’s mission is focused on gathering foreign intelligence and it is precluded from investigating Americans. But the US intelligence community’s massive collection efforts often incidentally gather Americans’ data in the process. Different spy agencies are required through a series of policies to minimize the exposure of Americans’ data unless it is relevant to a national security investigation.
For example, according to the watchdog’s recommendations, CIA analysts using the classified program see a pop-up box warning them that any information about US persons requires a valid foreign intelligence purpose. But, according to the document, analysts are not required to memorialize the justification for their queries. As a result, the board found, “auditing or reviewing U.S. Person (USP) queries is likely to be challenging and time-consuming.”
But those protective procedures have long garnered concerns from privacy and civil liberties advocates about how the US intelligence community handles Americans’ information when it is obtained as part of foreign intelligence-gathering efforts. Wyden in particular has long warned that the rules provide a “backdoor” loophole that allows foreign-focused spy agencies too much leeway with Americans’ data.
A CIA FAQ released with the materials said the agency is “precluded from collecting datasets pertaining to U.S. persons that lack intelligence value or are otherwise unrelated to one of CIA’s other authorized intelligence activities.”
“CIA recognizes and takes very seriously our obligation to respect the privacy and civil liberties of US persons in the conduct of our vital national security mission, and conducts our activities, including collection activities, in compliance with U.S. law, Executive Order 12333, and our Attorney General guidelines,” Kristi Scott, CIA’s privacy and civil liberties officer, said in a statement, referring to an executive order that broadly governs intelligence community activities not covered by US law.
“CIA is committed to transparency consistent with our obligation to protect intelligence sources and methods,” Scott said.